Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
94
static u_int32_t ack_sent, ack_recv;
static u_int32_t seq_sent, seq_recv;
static u_int16_t pptp_gre_call_id;
#define PPP_ADDRESS
0xFF
#define PPP_CONTROL
0x03
/* PPP Protocols */
#define PPP_PROTO_LCP
0xc021
#define PPP_PROTO_CHAP
0xc223
/* LCP Codes */
#define PPP_LCP_CODE_CONF_RQST
1
#define PPP_LCP_CODE_CONF_ACK
2
#define PPP_LCP_CODE_IDENT
12
/* LCP Config Options */
#define PPP_LCP_CONFIG_OPT_AUTH         3
#define PPP_LCP_CONFIG_OPT_MAGIC
5
#define PPP_LCP_CONFIG_OPT_PFC
7
#define PPP_LCP_CONFIG_OPT_ACFC
8
/* Auth Algorithms */
#define PPP_LCP_AUTH_CHAP_ALGO_MSCHAP
0x80
/* CHAP Codes */
#define PPP_CHAP_CODE_CHALLENGE
1
#define PPP_CHAP_CODE_RESPONCE
2
#define PPP_CHAP_CODE_SUCESS
3
#define PPP_CHAP_CODE_FAILURE
4
#define PPP_CHAP_CODE_MSCHAP_PASSWORD_V1
5
#define PPP_CHAP_CODE_MSCHAP_PASSWORD_V2
6
#define PPP_CHAP_CHALLENGE_SIZE
8
#define PPP_CHAP_RESPONCE_SIZE          49
#define MSCHAP_ERROR    "E=648 R=0"
struct ppp_header {
u_int8_t address;
u_int8_t control;
u_int16_t proto;
};
struct ppp_lcp_chap_header {
0

---